Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
John Scott-Railton Profile picture
@jsrailton
Sep 22, 2023 • 10 tweets • 6 min read • Read on X
Scrolly
🚨UPDATE your @Apple products now!

We @citizenlab w/TAG's @maddiestone caught #predator spyware attacks against a prominent pro-democracy Egyptian politician after he announced presidential ambitions.

Apple rushed a patch.

It gets crazier 1/

citizenlab.ca/2023/09/predat…
Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp. The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. In August and September 2023, Eltantawy’s Vodafone Egypt mobile connection was persistently selected for targeting via network injection; when Eltantawy visited certain websites not using HTTPS, a device installed at the border of Vodafone Egypt’s network automatically redirected him to a malicious website to infect his phone wi...
2/ Ahmed Eltantawy got in touch with us @citizenlab, worried his devices were targeted in #Egypt.

He was right. His iPhone on @VodafoneEgypt was targeted for network injection.

As he browsed the net, the attackers were trying to slip a #Predator infection onto his device.

Image
Image
Image
3/ It gets worse.

We attribute the spyware injection system to a @Sandvine Packet Logic product w/high confidence.

Sandvine has been accused in past of facilitating human rights abuses in the past.

Owned by NSO Group's former owner Francisco Partners.




Image
Image
Image
Image
4/ This kind of exploit delivery through injection DOES NOT require a target to click as our collaborator, the brilliant @maddiestone, points out in her post.

It's a seriously dangerous kind of attack & hard to protect against.
blog.google/threat-analysi…
Image
@maddiestone 5/ Apple moved quickly to fix the zero-day exploits @maddiestone & @billmarczak discovered.

We encourage everyone to immeidately update their apple products.

There is a piece of good security news buried in all this... Image
@maddiestone @billmarczak 6/ We believe & Apple's Security Engineering & Architecture Team confirms, Lockdown Mode would have blocked this attack!

We *strongly* encourage all Apple users that may be at risk because of who they are or what they do to enable Lockdown Mode!

support.apple.com/en-us/HT212650
Image
@maddiestone @billmarczak 7/ Ahmed ElTantawy wasn't just targeted with network injection!

He was also targeted with #Predator spyware links in decoy messages sent as texts & over @WhatsApp.

One of the attacks masqueraded as communications from the International Federation for Human Rights @fidh_en Image
@maddiestone @billmarczak @WhatsApp @fidh_en 8/ This summer the 🇺🇸US hit developer & distributor of #Predator spyware (Cytrox & Intellexa) with blacklisting.

This latest abuse revelation affirms the determination that the spyware continues to fuel human rights abuses.

By @ddimolfetta & @Post_AG
washingtonpost.com/national-secur…
Image
9/ Pulling back the lens from the tech side of this #Predator attack:

Mercenary spyware is autocrat fuel.

When you hack a pro-democracy presidential hopeful in an autocracy... you are doing dictatorship.

And spyware companies know exactly who they are selling to. Image
10/ Without brave victims like Ahmed Tantawy getting checked & coming forwards, these recent exploits would not have been found.

Billions of apple devices would still be vulnerable.

Including yours. Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with John Scott-Railton

John Scott-Railton Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @jsrailton

John Scott-Railton Profile picture
Aug 20
WHOA: megapublisher @axelspringer is asking a German court to ban an ad-blocker.

Their claim that should make everyone nervous:

The HTML/ CSS code of websites are protected computer programs.

And influencing they are displayed (e.g by removing ads) violates copyright.

1/Image
2/ Preventing ad-blocking would be a huge blow to German cybersecurity and privacy.

There are critical security & privacy reasons to influence how a websites code gets displayed.

Like stripping out dangerous code & malvertising.

Or blocking unwanted trackers.

This is why most governments do it on their systems.Image
3/Defining HTML/CSS as a protected computer program will quickly lead to absurdities touching every corner of the internet.

Just think of the potential infringements:

-Screen readers for the blind
-'Dark mode' bowser extensions
-Displaying snippets of code in a university class
-Inspecting & modifying code in your own browser
-Website translators
Read 7 tweets
John Scott-Railton Profile picture
Jul 10
NEW: Mexico's former president under investigation for taking bribes from spyware industry.

Contracts included #Pegasus deal.

Story from @TheRecord_Media's Suzanne Smalley 1/Image
Image
Image
2/ Mexico's former president is denying everything...

But folks may recall that Pegasus was massively and systematically abused in Mexico.

Against journalists, spouses of cartel victims, lawyers, families of cartel-disappeared people, anti-corruption groups etc. etc.

There were so many cases that we eventually had EIGHT investigative reports...
therecord.media/former-mexican…Image
3/ What still gives me chills is how many cases surfaced of people killed by cartels... or their family members... getting targeted with Pegasus spyware.

The #PegasusProject found even more potential cases in Mexico. Image
Image
Image
Image
Read 5 tweets
John Scott-Railton Profile picture
Jun 18
🚨NEW REPORT: exposing a new hacking tactic.

🇷🇺Russian state-backed hackers used an App-Specific Password attack against prominent Russia expert @KeirGiles & others.

It's like they know what we all expect from them...and then did the opposite 1/

By us @citizenlab & @google's GTIGImage
Image
Image
2/ Let's begin: @KeirGiles gets a message purporting to be from @StateDept asking for a consultation.

The attackers send the message from a @gmail, but CC'd a bunch of email addresses @ state.gov.

Strong credibility signal to have a bunch of gov ppl on the CC line right?

Well, what the attackers were counting on is that the State Dept mailserver just accepts all email addresses without emitting a bounce.

So they seem to have just created some fake State Dept staff names and addresses.Image
3/ The attackers wait for the 2nd interaction to introduce the pivotal deception: getting @KeirGiles to 'connect to a secure platform.'

In the next days they patiently walk him through what they want him to do, even sending a very official looking (but fake) State Dept. documentImage
Image
Read 10 tweets
John Scott-Railton Profile picture
Jun 12
🚨NEW INVESTIGATION: We just forensically unmasked #Paragon's Apple spyware.

Zero-click targets: Journalists. In 🇪🇺Europe.

Like 🇮🇹Italian reporter @ciropellegrino.

Reopen's #Italy's spyware scandal.

Follows our @citizenlab investigation of their Android spyware. 1/ Image
2/ Back in April, @Apple sent out a threat notification to a select group of users. Some got in touch with us @citizenlab to get analyzed.

They'd been targeted with a sophisticated zero-click attack (think: no click, no attachment to open, no mistake needed...).Image
3/ While my brilliant colleague @billmarczak was working on the phone of a prominent European journalist, he made a smoking gun discovery:

Requests to server matching our P1 fingerprint for #Paragon's graphite.

Paragon's 'undetectable' Apple spyware had just been found...Image
Image
Image
Read 13 tweets
John Scott-Railton Profile picture
Jun 9
NEW: #Italy's spyware scandal just deepened.

Just days ago, #Italy claimed to not know who targeted Journalist @fcancellato with #Paragon spyware.

But now the spyware company is dropping heavy hints that this wasn't the full story👇
2/ Last week the #Italian government published a report acknowledging that they were responsible for certain #paragon spyware cases.

But left the politically trickiest case unanswered...
3/ Paragon frames itself as the anti-NSO... a "clean" spyware company.

But it didn't take long for them to get mired in an mess scandal in #Italy.

Now it looks like they are trying to find a way to fully wash their hands of the affair...

Read 7 tweets
John Scott-Railton Profile picture
Jun 6
NEW: Italy admits hacking activists with #Paragon spyware.

Blow to the reputation of a mercenary spyware company that marketed itself as an ethically clean anti-NSO.

But the official investigation doesn't answer a big mystery that's bad for #Italy & Paragon 1/..

By @omerbenjImage
2/ While Italy confirms the activist cases, they deny doing the politically explosive one:

Journalist & @fanpage editor Francesco Cancellato, whose reporting has tangled with the Prime Minister.

So who pointed Paragon against @fcancellato?

None of the answers are good... Image
3/ If we take the Italian government's claims to not know who targeted Italian journalist @fcancellato at face value...

Then it is a very bad look for #Paragon to have this case unexplained.

Who pointed their Graphite spyware at this European journalist?Image
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(